What is GHSA-hf4p-4j9r-3cvx?

GHSA-hf4p-4j9r-3cvx is a security advisory published by GitHub Security Advisories with Medium severity. Incorrect Default Permissions in Beego

Which CVE IDs does GHSA-hf4p-4j9r-3cvx cover?

GHSA-hf4p-4j9r-3cvx covers the following CVE IDs: CVE-2019-16355. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hf4p-4j9r-3cvx?

GHSA-hf4p-4j9r-3cvx has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

Which products are affected by GHSA-hf4p-4j9r-3cvx?

GHSA-hf4p-4j9r-3cvx affects 2 products, including: go/github.com/beego/beego:\u003c 1.12.2; go/github.com/astaxie/beego:\u003c 1.12.2.

GHSA-hf4p-4j9r-3cvxMediumCVSS 5.5

Incorrect Default Permissions in Beego

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

April 22, 2024

🔗 CVE IDs covered (1)

CVE-2019-16355 →

📋 Description

The File Session Manager in Beego before 1.12.2 allows local users to read session files because of weak permissions for individual files.

🎯 Affected products2

go/github.com/beego/beego:< 1.12.2
go/github.com/astaxie/beego:< 1.12.2

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2019-16355
https://github.com/beego/beego/issues/3763
https://github.com/beego/beego/pull/3975/commits/f99cbe0fa40936f2f8dd28e70620c559b6e5e2fd
https://github.com/beego/beego/pull/3975
https://github.com/beego/beego/commit/bac2b31afecc65d9a89f9e473b8006c5edc0c8d1
https://github.com/advisories/GHSA-hf4p-4j9r-3cvx